Mark Barrera

VP of SEO @NewfoldDigital (@bluehost, @hostgator @webdotcom @domaindotcom @register). Past: @TrustRadius / @ZiffDavis

Interested in #ETA / #Entrepreneurship

[Mark Barrera @mark_barrera]

@RossHudgens Sad to see Google feeding the narrative of citations being the thing that we should focus on. It's the brand mentions and sentiment that shape the decisions people make when reading the AI summaries, not which links are there (and are bever clicked on)

[Ross Hudgens @RossHudgens]

“AI attribution is solved with the new Search Console features”.

Not so fast.

Google is adding impression data for *URLs* that appear in AI features. They are not reporting on the unlinked mentions in AI.

It is these mentions – at least until they become linked – that are the most valuable currently, and what we all need data on to better show the value of GEO programs.

Yes, this is a positive addition for search practitioners. But our problems are not solved.

In the example screenshot, as I understand from what’s being rolled out, Ahrefs and Semrush would not receive a tracked impression.

Yet it is those two words that are receiving all the value from this prompt. That’s problematic, because that’s the most important datapoint we are still all after and would love to see for the companies we help.

[Ross Hudgens @RossHudgens]

What's actually happening with listicle content right now — from someone in the trenches:

Google has meaningfully increased SERP diversity on listicle-heavy queries.

Where these used to be almost exclusively roundup results, we're now seeing a healthier mix of first-party product pages alongside traditional listicle content.

Here's what that means in practice:

1. Cannibalization risk has gone up.

Companies that scaled listicle volume to capture rankings — even those with dedicated landing pages — may be seeing traffic erosion as domain diversity increases.

The fix isn't to abandon the strategy. It's to audit more carefully and make sure your pages aren't competing with each other.

2. Product page SEO/GEO now matters more than ever.

With product pages appearing more frequently in these SERPs, the investment in what we call product page mapping — building out core use cases, industry pages, and role-specific pages for your entire ICP — has become a higher-priority lever.

3. Listicles still work.

They're just a more targeted play now. The real value today is as a supplement to your core product pages — particularly for keyword variations that don't justify a full page but make sense as focused, standalone listicle content.

The prolific, high-volume listicle approach is tightening. That doesn't mean past efforts were wasted.

Those pages built snowball effects: getting mentioned in other listicles, establishing moats in LLMs, and driving compounding visibility that still pays dividends.

The strategy isn't dead. It just requires more precision.

[Mark Barrera @mark_barrera]

The OpenAI Head of Monetization was on stage talking about ads in ChatGPT. The model doesn't see the ads. The model doesn't know they're there. Self-serve is on the roadmap.

[Mark Barrera @mark_barrera]

Spent the day at @tryprofound's Zero Click SF. 700+ marketers. @OpenAI, @stripe, @G2dotcom, @reddit, @figma, @iPullRank and more on stage.

Stripe's CMO: 20% of signups now involve agent assistance. Agent-to-agent commerce is being built.

https://t.co/RjpZK9ZmG2

[Alex Prompter @alex_prompter]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Mark Barrera @mark_barrera]

@JHTScherck @tryprofound I'll be there

[Mark Barrera @mark_barrera]

@iPullRank @Biograph What's the value you got from it? Anything big you learned or that they discovered about your health? How do you plan to use the data from all the analysis?

[Mark Barrera @mark_barrera]

I've been having this convo with a lot of people lately. Some get it right away after using Claude for their first time. Others are still clueless about where we are and what things are to come.

[Matt Shumer @mattshumer_]

https://t.co/ivXRKXJvQg

[Mark Barrera @mark_barrera]

@JHTScherck @ahrefs @thinking_slow Yep - Ahrefs/Semrush data vs reality feel VERY off. I blame their outdated methods for CTR estimates, but also search volume data has it's flaws. Both of which lead to bad traffic estimates.

[Mark Barrera @mark_barrera]

The final Google update for 2025 has started rolling out today.

[Google Search Central @googlesearchc]

Today we released the December 2025 core update. We'll update our ranking release history page when the rollout is complete: https://t.co/7dmc4qr2hX

[Ross Hudgens @RossHudgens]

What is "good" LLM visibility?

This chart assumes the methodology for prompt measurement is looking at BOFU, non-branded terms that represent the core products the company creates and nothing else.

I.E. - "what is the best content marketing software"

[Andrea Volpini @cyberandy]

ChatGPT isn’t just streaming text, it's now streaming 𝐞𝐧𝐭𝐢𝐭𝐢𝐞𝐬.

I have found traces of:

🔹 NER (people, orgs, events)
🔹 Moderation signals
🔹 A full product graph (title, price, rating, merchant…)
It’s how AI “sees” your entities & catalog.

👉 https://t.co/SaPCKvKY0e

[Mark Barrera @mark_barrera]

Why Peer Review Sites Are Losing Clicks but Gaining Power in the AI Era https://t.co/jvyP1dlD3g

Peer review sites have lost 70–80% of their organic traffic.

But in the GenAI era, they matter more than ever.
Reviews are no longer just proof, they fuel GEO strategies.

[Mark Barrera @mark_barrera]

Kicked off my Lunch with Legends (a chance to sit down with leaders I admire and share what I’m learning along the way) with @peeplaja.

We hit on consultancies, acquisitions, AI, events, and LinkedIn’s organic decline.

Check out what he’s built at https://t.co/rQLKvNwtDj

[Mark Barrera @mark_barrera]

@brodieseo @MalteLandwehr But not just for tracking rankings, but to feed those rankings to ChatGPT and the like who have been known to buy and use this data. https://t.co/pSBhjabqOo

[Mark Barrera @mark_barrera]

SEOs: be ready for Monday morning!
GSC impressions will look broken. Avg position will spike. Rank trackers may miss data.

This is not user behavior. It’s Google shutting down num=100 and cutting off machine-driven impressions from scrapers and AI tools.
https://t.co/PLCV6H02NS

[Mark Barrera @mark_barrera]

Everyone loves the headline:
“Scaling to $10M ARR with 3 FTEs and AI”

But look closer:

Agencies running outbound & ads

Contractors on SEO & ops

Vendors filling the rest

That’s not 3 people.

That’s spin - and it erodes trust in the brand.

[Mark Barrera @mark_barrera]

Great ideas rarely glide through unchallenged.

They disrupt. They make people uncomfortable.

And that resistance is the signal you’re onto something worth pursuing.

[Mark Barrera @mark_barrera]

Claude can now create and edit real files: Word, Excel, PowerPoint, and PDFs.

No more copy-paste. You ask, it delivers a ready-to-use file in one step.

ChatGPT can generate files too, but Claude makes it faster, smoother, and more polished — especially for document-heavy work.